@zarex/sveltekit 0.0.0-stage → 0.1.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Kodjogbe
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,107 @@
-# Temporary Holding Version
+# @zarex/sveltekit
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Hook Zarex pour SvelteKit — protège votre application contre les bots, les abus de trafic, les injections (SQL, XSS, SSRF...) et les fuites de données sensibles, en quelques lignes.
+
+Aucune dépendance à `@sveltejs/kit` à l'exécution.
+
+## Installation
+
+```bash
+npm install @zarex/sveltekit
+```
+
+## Démarrage rapide
+
+```ts
+// src/hooks.server.ts
+import { zarexHandle, shield, rateLimit } from "@zarex/sveltekit";
+
+export const handle = zarexHandle({
+  key: process.env.ZAREX_KEY!,
+  rules: [shield(), rateLimit({ max: 100, window: "1m" })],
+});
+```
+
+Avec d'autres hooks (`sequence`) :
+
+```ts
+import { sequence } from "@sveltejs/kit/hooks";
+import { zarexHandle } from "@zarex/sveltekit";
+
+export const handle = sequence(zarexHandle({ key, rules: [shield()] }), maHandle);
+```
+
+Une requête refusée reçoit automatiquement `403 Forbidden` (ou `429 Too Many Requests` avec l'en-tête `retry-after` pour une limite de débit) — sans aucun code supplémentaire.
+
+**Fail-open** : si Zarex est injoignable, lent ou répond de façon inattendue, la requête passe toujours. Une panne chez Zarex ne doit jamais faire tomber votre application.
+
+## L'adresse IP du visiteur
+
+Par défaut (`ipSource` non renseigné), l'adaptateur utilise `event.getClientAddress()`, calculé par SvelteKit selon la configuration de **votre** adaptateur de déploiement (`adapter-node` : variables `ADDRESS_HEADER` et `XFF_DEPTH` ; `adapter-vercel`, etc. — voir la documentation de votre adaptateur). Un mauvais réglage ici fait passer tous vos visiteurs pour une seule adresse IP.
+
+## Options
+
+```ts
+zarexHandle({
+  key: string,              // obligatoire : clé API du projet
+  rules: Rule[],            // obligatoire : 1 à 10 règles, voir ci-dessous
+  ipSource?: IpSource,      // défaut "framework" (voir ci-dessus)
+  inspectBody?: boolean,
+  secureHeaders?: boolean | SecureHeadersOptions,
+  responseGuard?: boolean | ResponseGuardOptions,
+  onDeny?: (event, decision) => Response | undefined,
+  onDegraded?: (event, decision) => void,
+  call?: (event) => ProtectCall | undefined,
+  timeoutMs?: number,       // défaut 500 ms
+  breaker?: BreakerOptions | false,
+})
+```
+
+### En-têtes de sécurité et surveillance des réponses
+
+```ts
+export const handle = zarexHandle({ ..., secureHeaders: true, responseGuard: true });
+```
+
+Appliqués automatiquement à toute réponse (y compris celle que `resolve(event)` aurait produite) — aucun appel supplémentaire à faire, contrairement au middleware Next.js.
+
+### Identifiants personnalisés (`call`)
+
+```ts
+export const handle = zarexHandle({
+  key,
+  rules: [rateLimit({ max: 100, window: "1m", characteristics: ["userId"] })],
+  call: (event) => ({ characteristics: { userId: event.locals.user?.id } }),
+});
+```
+
+Les valeurs sont hachées en SHA-256 avant l'envoi à Zarex. Une erreur dans cette fonction est silencieusement ignorée. `call` peut aussi fournir `tokensRequested`, `email`/`phone` ou `text` (voir [`@zarex/core`](https://www.npmjs.com/package/@zarex/core)).
+
+### Lire le résultat de la décision
+
+```ts
+// dans une route +page.server.ts ou +server.ts
+export function load({ locals }) {
+  console.log(locals.zarex?.verdict); // "ALLOW" | "DENY" | "ERROR"
+}
+```
+
+## Règles disponibles
+
+| Fonction | Résumé |
+|---|---|
+| `shield(opts?)` | Pare-feu applicatif : injection SQL, XSS, traversée de répertoires, SSRF, SSTI... |
+| `rateLimit({ max, window, ... })` | Limite de requêtes par visiteur sur une fenêtre de temps. |
+| `tokenBucket({ capacity, refillRate, interval })` | Budget de jetons avec pics autorisés. |
+| `detectBot(opts?)` | Détecte les robots connus, avec vérification DNS inversée. |
+| `requestFilter({ expressions, logic })` | Règles personnalisées sur IP, chemin, en-têtes, cookies, pays... |
+| `sensitiveInfo(opts?)` | Refuse une requête contenant une donnée sensible (nécessite `inspectBody`). |
+| `emailValidation(opts?)` | Valide un email donné via `call: () => ({ email })`. |
+| `phoneValidation(opts?)` | Valide un numéro donné, orienté opérateurs africains (MTN, Moov, Orange, Wave...). |
+| `promptInjection(opts?)` | Détecte les tentatives de manipulation d'un assistant IA, via `call: () => ({ text })`. |
+
+Chaque règle accepte `mode: "LIVE" | "DRY_RUN" | "OFF"`. Détails complets des options : voir [`@zarex/core`](https://www.npmjs.com/package/@zarex/core).
+
+## Licence
+
+MIT

package/dist/index.cjs

@@ -0,0 +1,101 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  CLOUDFLARE_RANGES: () => import_core2.CLOUDFLARE_RANGES,
+  PRIVATE_NETWORKS: () => import_core2.PRIVATE_NETWORKS,
+  createZarex: () => import_core2.createZarex,
+  detectBot: () => import_core2.detectBot,
+  emailValidation: () => import_core2.emailValidation,
+  phoneValidation: () => import_core2.phoneValidation,
+  promptInjection: () => import_core2.promptInjection,
+  rateLimit: () => import_core2.rateLimit,
+  requestFilter: () => import_core2.requestFilter,
+  secureHeaders: () => import_core2.secureHeaders,
+  sensitiveInfo: () => import_core2.sensitiveInfo,
+  shield: () => import_core2.shield,
+  tokenBucket: () => import_core2.tokenBucket,
+  withSecureHeaders: () => import_core2.withSecureHeaders,
+  zarexHandle: () => zarexHandle
+});
+module.exports = __toCommonJS(index_exports);
+var import_core = require("@zarex/core");
+var import_core2 = require("@zarex/core");
+function zarexHandle(options, extra = {}) {
+  const isInstance = typeof options.protect === "function";
+  const opts = isInstance ? extra : options;
+  const instance = isInstance ? options : (0, import_core.createZarex)({ ...options, ipSource: options.ipSource ?? "framework" });
+  const finalizer = (0, import_core.createWebFinalizer)({ secureHeaders: opts.secureHeaders, responseGuard: opts.responseGuard });
+  const finalize = async (res, request) => {
+    if (!finalizer || !(res instanceof Response)) return res;
+    try {
+      return await finalizer(res, request);
+    } catch {
+      return res;
+    }
+  };
+  return async function handle({ event, resolve }) {
+    try {
+      let frameworkIp;
+      try {
+        frameworkIp = event.getClientAddress();
+      } catch {
+        frameworkIp = void 0;
+      }
+      let call;
+      try {
+        call = opts.call?.(event);
+      } catch {
+        call = void 0;
+      }
+      const { decision, deny } = await (0, import_core.guardWebRequest)(instance, event.request, {
+        frameworkIp,
+        ...opts.inspectBody ? { inspectBody: true } : {},
+        ...opts.onDeny ? { onDeny: opts.onDeny } : {},
+        ...opts.onDegraded ? { onDegraded: opts.onDegraded } : {},
+        ...call ? { call } : {}
+      });
+      if (decision) event.locals["zarex"] = decision;
+      if (deny) return finalize(deny, event.request);
+    } catch {
+    }
+    return finalize(await resolve(event), event.request);
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  CLOUDFLARE_RANGES,
+  PRIVATE_NETWORKS,
+  createZarex,
+  detectBot,
+  emailValidation,
+  phoneValidation,
+  promptInjection,
+  rateLimit,
+  requestFilter,
+  secureHeaders,
+  sensitiveInfo,
+  shield,
+  tokenBucket,
+  withSecureHeaders,
+  zarexHandle
+});
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import { createWebFinalizer, createZarex, guardWebRequest, type ResponseGuardOptions, type SecureHeadersOptions, type Decision, type ProtectCall, type WebGuardOptions, type Zarex, type ZarexOptions } from \"@zarex/core\";\r\n\r\n/** Ce dont on a besoin de l'évènement SvelteKit (types minimaux : pas de dépendance à @sveltejs/kit). */\r\nexport interface SvelteEventLike {\r\n  request: Request;\r\n  getClientAddress(): string;\r\n  locals: Record<string, unknown>;\r\n}\r\n\r\nexport interface SvelteZarexOptions extends Omit<ZarexOptions, \"ipSource\"> {\r\n  /**\r\n   * Défaut : \"framework\" — l'adresse est celle de `event.getClientAddress()`, que SvelteKit calcule selon\r\n   * la configuration de votre adaptateur (adapter-node : variables ADDRESS_HEADER et XFF_DEPTH ; adapter-vercel, etc.).\r\n   */\r\n  ipSource?: ZarexOptions[\"ipSource\"];\r\n  inspectBody?: boolean;\r\n  /** En-têtes de sécurité ajoutés à chaque réponse (true = défauts prudents). */\r\n  secureHeaders?: SecureHeadersOptions | boolean;\r\n  /** Surveille les réponses : masque les cartes bancaires, clés d'API, etc. */\r\n  responseGuard?: ResponseGuardOptions | boolean;\r\n  onDeny?: WebGuardOptions[\"onDeny\"];\r\n  onDegraded?: WebGuardOptions[\"onDegraded\"];\r\n  call?: (event: SvelteEventLike) => ProtectCall | undefined;\r\n}\r\n\r\n/**\r\n *   // src/hooks.server.ts\r\n *   export const handle = zarexHandle({ key, baseUrl, rules: [shield(), rateLimit({ max: 100, window: \"1m\" })] });\r\n *   // ou avec d'autres hooks : export const handle = sequence(zarexHandle({...}), maHandle);\r\n *\r\n * La décision est dans `event.locals.zarex`.\r\n */\r\nexport function zarexHandle(options: SvelteZarexOptions | Zarex, extra: Pick<SvelteZarexOptions, \"inspectBody\" | \"onDeny\" | \"onDegraded\" | \"call\" | \"secureHeaders\" | \"responseGuard\"> = {}) {\r\n  const isInstance = typeof (options as Zarex).protect === \"function\";\r\n  const opts = (isInstance ? extra : options) as SvelteZarexOptions;\r\n  const instance: Zarex = isInstance\r\n    ? (options as Zarex)\r\n    : createZarex({ ...(options as SvelteZarexOptions), ipSource: (options as SvelteZarexOptions).ipSource ?? \"framework\" });\r\n\r\n  const finalizer = createWebFinalizer({ secureHeaders: opts.secureHeaders, responseGuard: opts.responseGuard });\r\n  const finalize = async <T>(res: T, request: Request): Promise<T> => {\r\n    if (!finalizer || !(res instanceof Response)) return res;\r\n    try {\r\n      return (await finalizer(res, request)) as T;\r\n    } catch {\r\n      return res;\r\n    }\r\n  };\r\n\r\n  return async function handle<R>({ event, resolve }: { event: SvelteEventLike; resolve: (event: SvelteEventLike) => R | Promise<R> }): Promise<R | Response> {\r\n    try {\r\n      let frameworkIp: string | undefined;\r\n      try {\r\n        frameworkIp = event.getClientAddress(); // lève une erreur si l'adaptateur ne sait pas l'IP\r\n      } catch {\r\n        frameworkIp = undefined;\r\n      }\r\n      let call: ProtectCall | undefined;\r\n      try {\r\n        call = opts.call?.(event);\r\n      } catch {\r\n        call = undefined;\r\n      }\r\n      const { decision, deny } = await guardWebRequest(instance, event.request, {\r\n        frameworkIp,\r\n        ...(opts.inspectBody ? { inspectBody: true } : {}),\r\n        ...(opts.onDeny ? { onDeny: opts.onDeny } : {}),\r\n        ...(opts.onDegraded ? { onDegraded: opts.onDegraded } : {}),\r\n        ...(call ? { call } : {}),\r\n      });\r\n      if (decision) event.locals[\"zarex\"] = decision;\r\n      if (deny) return finalize(deny, event.request);\r\n    } catch {\r\n      /* fail-open */\r\n    }\r\n    return finalize(await resolve(event), event.request);\r\n  };\r\n}\r\n\r\nexport {\r\n  shield,\r\n  rateLimit,\r\n  tokenBucket,\r\n  detectBot,\r\n  requestFilter,\r\n  sensitiveInfo,\r\n  emailValidation,\r\n  phoneValidation,\r\n  promptInjection,\r\n  secureHeaders,\r\n  withSecureHeaders,\r\n  createZarex,\r\n  PRIVATE_NETWORKS,\r\n  CLOUDFLARE_RANGES,\r\n} from \"@zarex/core\";\r\nexport type { SecureHeadersOptions, ResponseGuardOptions, ResponseGuardEvent } from \"@zarex/core\";\r\nexport type { Decision, Zarex, ZarexOptions, IpSource, Rule, ProtectCall } from \"@zarex/core\";"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,kBAA6M;AA+E7M,IAAAA,eAeO;AA9DA,SAAS,YAAY,SAAqC,QAAwH,CAAC,GAAG;AAC3L,QAAM,aAAa,OAAQ,QAAkB,YAAY;AACzD,QAAM,OAAQ,aAAa,QAAQ;AACnC,QAAM,WAAkB,aACnB,cACD,yBAAY,EAAE,GAAI,SAAgC,UAAW,QAA+B,YAAY,YAAY,CAAC;AAEzH,QAAM,gBAAY,gCAAmB,EAAE,eAAe,KAAK,eAAe,eAAe,KAAK,cAAc,CAAC;AAC7G,QAAM,WAAW,OAAU,KAAQ,YAAiC;AAClE,QAAI,CAAC,aAAa,EAAE,eAAe,UAAW,QAAO;AACrD,QAAI;AACF,aAAQ,MAAM,UAAU,KAAK,OAAO;AAAA,IACtC,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAEA,SAAO,eAAe,OAAU,EAAE,OAAO,QAAQ,GAA2G;AAC1J,QAAI;AACF,UAAI;AACJ,UAAI;AACF,sBAAc,MAAM,iBAAiB;AAAA,MACvC,QAAQ;AACN,sBAAc;AAAA,MAChB;AACA,UAAI;AACJ,UAAI;AACF,eAAO,KAAK,OAAO,KAAK;AAAA,MAC1B,QAAQ;AACN,eAAO;AAAA,MACT;AACA,YAAM,EAAE,UAAU,KAAK,IAAI,UAAM,6BAAgB,UAAU,MAAM,SAAS;AAAA,QACxE;AAAA,QACA,GAAI,KAAK,cAAc,EAAE,aAAa,KAAK,IAAI,CAAC;AAAA,QAChD,GAAI,KAAK,SAAS,EAAE,QAAQ,KAAK,OAAO,IAAI,CAAC;AAAA,QAC7C,GAAI,KAAK,aAAa,EAAE,YAAY,KAAK,WAAW,IAAI,CAAC;AAAA,QACzD,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;AAAA,MACzB,CAAC;AACD,UAAI,SAAU,OAAM,OAAO,OAAO,IAAI;AACtC,UAAI,KAAM,QAAO,SAAS,MAAM,MAAM,OAAO;AAAA,IAC/C,QAAQ;AAAA,IAER;AACA,WAAO,SAAS,MAAM,QAAQ,KAAK,GAAG,MAAM,OAAO;AAAA,EACrD;AACF;","names":["import_core"]}

package/dist/index.d.cts

@@ -0,0 +1,37 @@
+import { ZarexOptions, SecureHeadersOptions, ResponseGuardOptions, WebGuardOptions, ProtectCall, Zarex } from '@zarex/core';
+export { CLOUDFLARE_RANGES, Decision, IpSource, PRIVATE_NETWORKS, ProtectCall, ResponseGuardEvent, ResponseGuardOptions, Rule, SecureHeadersOptions, Zarex, ZarexOptions, createZarex, detectBot, emailValidation, phoneValidation, promptInjection, rateLimit, requestFilter, secureHeaders, sensitiveInfo, shield, tokenBucket, withSecureHeaders } from '@zarex/core';
+
+/** Ce dont on a besoin de l'évènement SvelteKit (types minimaux : pas de dépendance à @sveltejs/kit). */
+interface SvelteEventLike {
+    request: Request;
+    getClientAddress(): string;
+    locals: Record<string, unknown>;
+}
+interface SvelteZarexOptions extends Omit<ZarexOptions, "ipSource"> {
+    /**
+     * Défaut : "framework" — l'adresse est celle de `event.getClientAddress()`, que SvelteKit calcule selon
+     * la configuration de votre adaptateur (adapter-node : variables ADDRESS_HEADER et XFF_DEPTH ; adapter-vercel, etc.).
+     */
+    ipSource?: ZarexOptions["ipSource"];
+    inspectBody?: boolean;
+    /** En-têtes de sécurité ajoutés à chaque réponse (true = défauts prudents). */
+    secureHeaders?: SecureHeadersOptions | boolean;
+    /** Surveille les réponses : masque les cartes bancaires, clés d'API, etc. */
+    responseGuard?: ResponseGuardOptions | boolean;
+    onDeny?: WebGuardOptions["onDeny"];
+    onDegraded?: WebGuardOptions["onDegraded"];
+    call?: (event: SvelteEventLike) => ProtectCall | undefined;
+}
+/**
+ *   // src/hooks.server.ts
+ *   export const handle = zarexHandle({ key, baseUrl, rules: [shield(), rateLimit({ max: 100, window: "1m" })] });
+ *   // ou avec d'autres hooks : export const handle = sequence(zarexHandle({...}), maHandle);
+ *
+ * La décision est dans `event.locals.zarex`.
+ */
+declare function zarexHandle(options: SvelteZarexOptions | Zarex, extra?: Pick<SvelteZarexOptions, "inspectBody" | "onDeny" | "onDegraded" | "call" | "secureHeaders" | "responseGuard">): <R>({ event, resolve }: {
+    event: SvelteEventLike;
+    resolve: (event: SvelteEventLike) => R | Promise<R>;
+}) => Promise<R | Response>;
+
+export { type SvelteEventLike, type SvelteZarexOptions, zarexHandle };

package/dist/index.d.ts

@@ -0,0 +1,37 @@
+import { ZarexOptions, SecureHeadersOptions, ResponseGuardOptions, WebGuardOptions, ProtectCall, Zarex } from '@zarex/core';
+export { CLOUDFLARE_RANGES, Decision, IpSource, PRIVATE_NETWORKS, ProtectCall, ResponseGuardEvent, ResponseGuardOptions, Rule, SecureHeadersOptions, Zarex, ZarexOptions, createZarex, detectBot, emailValidation, phoneValidation, promptInjection, rateLimit, requestFilter, secureHeaders, sensitiveInfo, shield, tokenBucket, withSecureHeaders } from '@zarex/core';
+
+/** Ce dont on a besoin de l'évènement SvelteKit (types minimaux : pas de dépendance à @sveltejs/kit). */
+interface SvelteEventLike {
+    request: Request;
+    getClientAddress(): string;
+    locals: Record<string, unknown>;
+}
+interface SvelteZarexOptions extends Omit<ZarexOptions, "ipSource"> {
+    /**
+     * Défaut : "framework" — l'adresse est celle de `event.getClientAddress()`, que SvelteKit calcule selon
+     * la configuration de votre adaptateur (adapter-node : variables ADDRESS_HEADER et XFF_DEPTH ; adapter-vercel, etc.).
+     */
+    ipSource?: ZarexOptions["ipSource"];
+    inspectBody?: boolean;
+    /** En-têtes de sécurité ajoutés à chaque réponse (true = défauts prudents). */
+    secureHeaders?: SecureHeadersOptions | boolean;
+    /** Surveille les réponses : masque les cartes bancaires, clés d'API, etc. */
+    responseGuard?: ResponseGuardOptions | boolean;
+    onDeny?: WebGuardOptions["onDeny"];
+    onDegraded?: WebGuardOptions["onDegraded"];
+    call?: (event: SvelteEventLike) => ProtectCall | undefined;
+}
+/**
+ *   // src/hooks.server.ts
+ *   export const handle = zarexHandle({ key, baseUrl, rules: [shield(), rateLimit({ max: 100, window: "1m" })] });
+ *   // ou avec d'autres hooks : export const handle = sequence(zarexHandle({...}), maHandle);
+ *
+ * La décision est dans `event.locals.zarex`.
+ */
+declare function zarexHandle(options: SvelteZarexOptions | Zarex, extra?: Pick<SvelteZarexOptions, "inspectBody" | "onDeny" | "onDegraded" | "call" | "secureHeaders" | "responseGuard">): <R>({ event, resolve }: {
+    event: SvelteEventLike;
+    resolve: (event: SvelteEventLike) => R | Promise<R>;
+}) => Promise<R | Response>;
+
+export { type SvelteEventLike, type SvelteZarexOptions, zarexHandle };

package/dist/index.js

@@ -0,0 +1,77 @@
+// src/index.ts
+import { createWebFinalizer, createZarex, guardWebRequest } from "@zarex/core";
+import {
+  shield,
+  rateLimit,
+  tokenBucket,
+  detectBot,
+  requestFilter,
+  sensitiveInfo,
+  emailValidation,
+  phoneValidation,
+  promptInjection,
+  secureHeaders,
+  withSecureHeaders,
+  createZarex as createZarex2,
+  PRIVATE_NETWORKS,
+  CLOUDFLARE_RANGES
+} from "@zarex/core";
+function zarexHandle(options, extra = {}) {
+  const isInstance = typeof options.protect === "function";
+  const opts = isInstance ? extra : options;
+  const instance = isInstance ? options : createZarex({ ...options, ipSource: options.ipSource ?? "framework" });
+  const finalizer = createWebFinalizer({ secureHeaders: opts.secureHeaders, responseGuard: opts.responseGuard });
+  const finalize = async (res, request) => {
+    if (!finalizer || !(res instanceof Response)) return res;
+    try {
+      return await finalizer(res, request);
+    } catch {
+      return res;
+    }
+  };
+  return async function handle({ event, resolve }) {
+    try {
+      let frameworkIp;
+      try {
+        frameworkIp = event.getClientAddress();
+      } catch {
+        frameworkIp = void 0;
+      }
+      let call;
+      try {
+        call = opts.call?.(event);
+      } catch {
+        call = void 0;
+      }
+      const { decision, deny } = await guardWebRequest(instance, event.request, {
+        frameworkIp,
+        ...opts.inspectBody ? { inspectBody: true } : {},
+        ...opts.onDeny ? { onDeny: opts.onDeny } : {},
+        ...opts.onDegraded ? { onDegraded: opts.onDegraded } : {},
+        ...call ? { call } : {}
+      });
+      if (decision) event.locals["zarex"] = decision;
+      if (deny) return finalize(deny, event.request);
+    } catch {
+    }
+    return finalize(await resolve(event), event.request);
+  };
+}
+export {
+  CLOUDFLARE_RANGES,
+  PRIVATE_NETWORKS,
+  createZarex2 as createZarex,
+  detectBot,
+  emailValidation,
+  phoneValidation,
+  promptInjection,
+  rateLimit,
+  requestFilter,
+  secureHeaders,
+  sensitiveInfo,
+  shield,
+  tokenBucket,
+  withSecureHeaders,
+  zarexHandle
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import { createWebFinalizer, createZarex, guardWebRequest, type ResponseGuardOptions, type SecureHeadersOptions, type Decision, type ProtectCall, type WebGuardOptions, type Zarex, type ZarexOptions } from \"@zarex/core\";\r\n\r\n/** Ce dont on a besoin de l'évènement SvelteKit (types minimaux : pas de dépendance à @sveltejs/kit). */\r\nexport interface SvelteEventLike {\r\n  request: Request;\r\n  getClientAddress(): string;\r\n  locals: Record<string, unknown>;\r\n}\r\n\r\nexport interface SvelteZarexOptions extends Omit<ZarexOptions, \"ipSource\"> {\r\n  /**\r\n   * Défaut : \"framework\" — l'adresse est celle de `event.getClientAddress()`, que SvelteKit calcule selon\r\n   * la configuration de votre adaptateur (adapter-node : variables ADDRESS_HEADER et XFF_DEPTH ; adapter-vercel, etc.).\r\n   */\r\n  ipSource?: ZarexOptions[\"ipSource\"];\r\n  inspectBody?: boolean;\r\n  /** En-têtes de sécurité ajoutés à chaque réponse (true = défauts prudents). */\r\n  secureHeaders?: SecureHeadersOptions | boolean;\r\n  /** Surveille les réponses : masque les cartes bancaires, clés d'API, etc. */\r\n  responseGuard?: ResponseGuardOptions | boolean;\r\n  onDeny?: WebGuardOptions[\"onDeny\"];\r\n  onDegraded?: WebGuardOptions[\"onDegraded\"];\r\n  call?: (event: SvelteEventLike) => ProtectCall | undefined;\r\n}\r\n\r\n/**\r\n *   // src/hooks.server.ts\r\n *   export const handle = zarexHandle({ key, baseUrl, rules: [shield(), rateLimit({ max: 100, window: \"1m\" })] });\r\n *   // ou avec d'autres hooks : export const handle = sequence(zarexHandle({...}), maHandle);\r\n *\r\n * La décision est dans `event.locals.zarex`.\r\n */\r\nexport function zarexHandle(options: SvelteZarexOptions | Zarex, extra: Pick<SvelteZarexOptions, \"inspectBody\" | \"onDeny\" | \"onDegraded\" | \"call\" | \"secureHeaders\" | \"responseGuard\"> = {}) {\r\n  const isInstance = typeof (options as Zarex).protect === \"function\";\r\n  const opts = (isInstance ? extra : options) as SvelteZarexOptions;\r\n  const instance: Zarex = isInstance\r\n    ? (options as Zarex)\r\n    : createZarex({ ...(options as SvelteZarexOptions), ipSource: (options as SvelteZarexOptions).ipSource ?? \"framework\" });\r\n\r\n  const finalizer = createWebFinalizer({ secureHeaders: opts.secureHeaders, responseGuard: opts.responseGuard });\r\n  const finalize = async <T>(res: T, request: Request): Promise<T> => {\r\n    if (!finalizer || !(res instanceof Response)) return res;\r\n    try {\r\n      return (await finalizer(res, request)) as T;\r\n    } catch {\r\n      return res;\r\n    }\r\n  };\r\n\r\n  return async function handle<R>({ event, resolve }: { event: SvelteEventLike; resolve: (event: SvelteEventLike) => R | Promise<R> }): Promise<R | Response> {\r\n    try {\r\n      let frameworkIp: string | undefined;\r\n      try {\r\n        frameworkIp = event.getClientAddress(); // lève une erreur si l'adaptateur ne sait pas l'IP\r\n      } catch {\r\n        frameworkIp = undefined;\r\n      }\r\n      let call: ProtectCall | undefined;\r\n      try {\r\n        call = opts.call?.(event);\r\n      } catch {\r\n        call = undefined;\r\n      }\r\n      const { decision, deny } = await guardWebRequest(instance, event.request, {\r\n        frameworkIp,\r\n        ...(opts.inspectBody ? { inspectBody: true } : {}),\r\n        ...(opts.onDeny ? { onDeny: opts.onDeny } : {}),\r\n        ...(opts.onDegraded ? { onDegraded: opts.onDegraded } : {}),\r\n        ...(call ? { call } : {}),\r\n      });\r\n      if (decision) event.locals[\"zarex\"] = decision;\r\n      if (deny) return finalize(deny, event.request);\r\n    } catch {\r\n      /* fail-open */\r\n    }\r\n    return finalize(await resolve(event), event.request);\r\n  };\r\n}\r\n\r\nexport {\r\n  shield,\r\n  rateLimit,\r\n  tokenBucket,\r\n  detectBot,\r\n  requestFilter,\r\n  sensitiveInfo,\r\n  emailValidation,\r\n  phoneValidation,\r\n  promptInjection,\r\n  secureHeaders,\r\n  withSecureHeaders,\r\n  createZarex,\r\n  PRIVATE_NETWORKS,\r\n  CLOUDFLARE_RANGES,\r\n} from \"@zarex/core\";\r\nexport type { SecureHeadersOptions, ResponseGuardOptions, ResponseGuardEvent } from \"@zarex/core\";\r\nexport type { Decision, Zarex, ZarexOptions, IpSource, Rule, ProtectCall } from \"@zarex/core\";"],"mappings":";AAAA,SAAS,oBAAoB,aAAa,uBAAmK;AA+E7M;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,eAAAA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AA9DA,SAAS,YAAY,SAAqC,QAAwH,CAAC,GAAG;AAC3L,QAAM,aAAa,OAAQ,QAAkB,YAAY;AACzD,QAAM,OAAQ,aAAa,QAAQ;AACnC,QAAM,WAAkB,aACnB,UACD,YAAY,EAAE,GAAI,SAAgC,UAAW,QAA+B,YAAY,YAAY,CAAC;AAEzH,QAAM,YAAY,mBAAmB,EAAE,eAAe,KAAK,eAAe,eAAe,KAAK,cAAc,CAAC;AAC7G,QAAM,WAAW,OAAU,KAAQ,YAAiC;AAClE,QAAI,CAAC,aAAa,EAAE,eAAe,UAAW,QAAO;AACrD,QAAI;AACF,aAAQ,MAAM,UAAU,KAAK,OAAO;AAAA,IACtC,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAEA,SAAO,eAAe,OAAU,EAAE,OAAO,QAAQ,GAA2G;AAC1J,QAAI;AACF,UAAI;AACJ,UAAI;AACF,sBAAc,MAAM,iBAAiB;AAAA,MACvC,QAAQ;AACN,sBAAc;AAAA,MAChB;AACA,UAAI;AACJ,UAAI;AACF,eAAO,KAAK,OAAO,KAAK;AAAA,MAC1B,QAAQ;AACN,eAAO;AAAA,MACT;AACA,YAAM,EAAE,UAAU,KAAK,IAAI,MAAM,gBAAgB,UAAU,MAAM,SAAS;AAAA,QACxE;AAAA,QACA,GAAI,KAAK,cAAc,EAAE,aAAa,KAAK,IAAI,CAAC;AAAA,QAChD,GAAI,KAAK,SAAS,EAAE,QAAQ,KAAK,OAAO,IAAI,CAAC;AAAA,QAC7C,GAAI,KAAK,aAAa,EAAE,YAAY,KAAK,WAAW,IAAI,CAAC;AAAA,QACzD,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;AAAA,MACzB,CAAC;AACD,UAAI,SAAU,OAAM,OAAO,OAAO,IAAI;AACtC,UAAI,KAAM,QAAO,SAAS,MAAM,MAAM,OAAO;AAAA,IAC/C,QAAQ;AAAA,IAER;AACA,WAAO,SAAS,MAAM,QAAQ,KAAK,GAAG,MAAM,OAAO;AAAA,EACrD;AACF;","names":["createZarex"]}

package/package.json

@@ -1,6 +1,43 @@
 {
   "name": "@zarex/sveltekit",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.1.1",
+  "description": "Zarex — SvelteKit (hook handle)",
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.js"
+      },
+      "require": {
+        "types": "./dist/index.d.cts",
+        "default": "./dist/index.cjs"
+      }
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "sideEffects": false,
+  "dependencies": {
+    "@zarex/core": "^0.1.1"
+  },
+  "peerDependencies": {
+    "@sveltejs/kit": ">=1"
+  },
+  "peerDependenciesMeta": {
+    "@sveltejs/kit": {
+      "optional": true
+    }
+  },
+  "scripts": {
+    "build": "tsup"
+  }
 }